DSH Process Guardian
中文说明
A Cordis plugin for DeepSeek Harness (DSH) that guards against accidental, model-authored termination of the DSH host process running the task.
Why this exists
The incident that motivated this plugin was not an automatic DSH “stale state restore.” Two independent root tasks were editing the same workspace toward opposing goals. One model saw the other task's writes, misdiagnosed DSH itself as the writer, found the dsh web PID, and issued the equivalent of:
kill <dsh-host-pid>
Because the Bash tool is a child of that DSH process, the signal stopped the host, interrupted every hosted task, and prevented the tool result from being recorded normally.
The command and its UI description were model-authored Bash arguments. DSH's Bash source explicitly places deployment policy at tools/pre-execute, while DSH's current tool runtime provides a monotonic tools.guard() stage whose denials cannot be force-allowed by a later listener. This plugin installs that guard and adds a matching system-prompt invariant.
Relevant upstream contracts:
What it blocks
The plugin captures the host PID, parent PID, process group, command line, executable names, and dsh web --port value at startup. Before a bash, pwsh, or submitted terminal_send command runs, it denies recognizable attempts such as:
kill <dsh-host-pid>
kill $PPID
kill -- -<dsh-process-group>
pkill -f 'dsh web'
killall node
pgrep -f dsh | xargs kill
lsof -ti :<dsh-web-port> | xargs kill
node -e 'process.kill(<dsh-host-pid>)'
Signal-zero probes such as kill -0 <dsh-host-pid> remain allowed, as do signals to unrelated application-server PIDs. For example, kill <next-dev-pid> and pkill -P <dsh-host-pid> next can still stop a DSH-owned development child without killing DSH itself.
Denied calls return an actionable model-visible error: inspect concurrent root tasks in the workspace or ask the user, and do not retry with another termination primitive.
Install
Install the tagged release into the web profile with DSH's plugin manager:
dsh plugin --profile web add -w github:emeryxu1-blip/dsh-process-guardian#v0.1.1
The explicit -w acknowledges that a DSH profile is the root of its one-package pnpm workspace. This installs the package and appends its declared dsh.bundle to the profile. Confirm the composed layer without starting another server:
dsh --profile web --dump-config
Restart DSH once after installation so the guard is active before starting new tasks.
To remove it later:
dsh plugin --profile web remove dsh-process-guardian
Configuration
| Option | Default | Purpose |
|---|
protectProcessGroup | true | Protect the discovered DSH process group from negative-PGID signals. |
protectTerminalSend | true | Inspect commands submitted through a persistent terminal. |
additionalProtectedPids | [] | Extra fixed PIDs to protect for the lifetime of this DSH process. |
additionalProtectedPorts | [] | Extra ports to protect in dynamic lsof/xargs kill selectors. |
additionalProcessNames | [] | Extra executable or selector names treated as protected. |
The DSH host PID and --port are discovered automatically. Do not hard-code them in normal configuration.
Scope and limits
This plugin fixes the direct self-termination path. It does not serialize unrelated root tasks or decide which task owns a shared workspace. Avoid running opposing goals against the same checkout; use separate worktrees or stop one task first.
Static command inspection is not syscall isolation. Opaque scripts, package scripts, encoded commands, native binaries, or commands assembled across multiple terminal writes can hide a signal from the classifier. See SECURITY.md and use an OS/container boundary for hostile code.
Development
pnpm install
pnpm test
The test suite includes the original direct-PID failure shape, process-group variants, name selectors, dynamic pipelines, embedded language APIs, signal-zero probes, unrelated development-server kills, terminal submissions, configuration validation, and Cordis registration behavior.
License
MIT
